So, I've got a question
If any app can run on localhost, use a blob url, or set its ffos origin to be app://codexa.github.io/, is that really any more secure than
*?
Eh, no, not in that case, but we shouldn't allow blob urls, and we have to trust Mozilla that they won't allow other apps to use that origin
localhost is dubious, but if software has access to localhost they can do anything they want
hmm, ok
So, should we allow localhost?
I think so, also because otherwise it would be hard for other to test Firetext
Ok!
Well, not really, only the Dropbox thing
I don't think there's a big security reason not to, anyways
since we allow localhost, should we also allow file:///
Yes, I think so
hmm, so I am not succeeding in filtering
window.opener.location with regexs
apparently, I cannot access
window.opener.location.*
You could send a postMessage from the opener and look at
messageEvent.origin
We would need to post a message to
* to let the app know it's ready and then post one back with the origin
Yes, that works too
Soo, two questions
Sure
There are now multiple things in the firetext folder that aren't really needed for a production bundle
Although really, the only one that's important is the automation exe
Important as in, large
And second
Yeah. I manually remove all of those files/folders. Hoping to get a build process sometime.
Could be as simple as a bash/shell script
It would be nice to have a single minified css and a single js file, I think that would be better for performance
Oh yeah!
Less requests
So, what would the script do exactly? Create a build directory?
That is what most do. We could (in order):
- Add keys (e.g. Splunk Mint key)
- Concatenate js/css
- Minify js/css
- Zip necessary files
- output in /build
What do you think?
Eventually, we could add testing too
Yep, sounds good. It would be nice if we could keep the development cycle short though for those who test from localhost (not me currenlty sadly). E.g. ideally keep building < 2 seconds if possible.
Or not require building at all obviously
That's a great goal
btw, it works without localhost right now
Lol at "That's a great goal"
That's a great goal twiss, keep believing
:)
no, jk
Oh, I wasn't meaning it that way, sorry
I know :)
But it might come to be true though, 2 seconds is a short time
What do you mean with "it works without localhost right now"?
Oh ok :)
I am running in firefox without using a local server
I am running in firefox without using a local server
e.g. just opening firetext through the file:// protocol